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Risk modeling in a new paradigm: 
developing new insight and foresight 
on structural risk 


Introduction 


Why did sophisticated risk management tools fail to predict the 2008 crisis or at least safeguard financial institutions 
fromits effects? Executives, shareholders, and risk experts have argued this question at length, and one important 
conclusion is disturbingly simple: managers relied too heavily on short-sighted models and too lightly on their own 
expertise and insight. As management shifts from wondering what hit them to optimizing returns in the ongoing recovery, 
the temptation is to allow risk management to slip down the list of priorities. Returning to business as usual, however, 
would be a serious mistake. If anything is to be learned from the crisis, it is that nothing substitutes for human judgment in 
evaluating business risks and setting the right course of action, in good times as well as bad. 


Financial institution executives and managers must understand, in a systematic and comprehensive way, the risks 
associated with their business. The best way for managers to build this knowledge is by reaching deep into an 
organization for insight and monitoring key economic indicators that provide foresight on structural risk — the key risks 
that influence in a decisive way a financial institution's P&L statement and balance sheet. 


The risk modeling methodology outlined below is one dimension of McKinsey's integrated approach to strategic risk 
management. McKinsey has implemented this new risk paradigm with leading clients as a best practice to support 
both medium-term positioning as well as strategic decision making in extraordinary circumstances. Itis a strategic and 
holistic approach to risk, built around a number of elements: 


= Improved transparency, understanding and modeling of risk 

= Aclear decision on which risks to “own” and which risks to transfer or mitigate’ 

=  Thecreation of a more resilient organization and processes that help the firm to be proactive in risk mitigation 
= The development of a true risk culture 

= Anewapproach to regulation. 


The focus of the present paper is on the first of these elements: the development of superior understanding (insight and 
foresight) on structural risk. 


The flaws of current risk methodologies 


The combination of flawed risk models and managerial complacency was a major factor leading to the financial 
crisis. On the one hand, risk models overemphasized historical data and failed to detect problems that should 

have been recognized as advance warning of the looming crisis. On the other hand, managers’ overall risk mindset 
placed excessive confidence in the models and underestimated the importance of individual judgment and personal 
responsibility. This combination of short-sightedness and complacency was disastrous for the financial services 
industry. 


First, the use of standard assumptions in mathematical analysis of historic data produces flawed risk calculations, 
because they assign disproportionate weight to recent information when predicting the future. Consequently, many 


1 See McKinsey Risk Working Paper Number 23, “Getting Risk Ownership Right” 


models actually encourage pro-cyclical behavior, a fact that has been widely noted in relation to the capital requirements 
defined by Basel II (Exhibit 1) and will likely become an issue for insurance companies under Solvency Il. 


Exhibit 1 
The procyclicality of Basel Il can have a severe DISGUISED CLIENT EXAMPLE 
negative impact on capital requirements 
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SOURCE: R. Repullo; J. Suarez: The procyclical effects at Basel Il; Moody's; annual issuer-weighted corporate default rates; McKinsey 


To be fair, risk managers recognized this short-sightedness and sought to make their analyses more accurate and 
forward-looking by drawing on the predictive power of markets with the mark-to-market approach. They argued, in 
particular, that the future and forward markets reliably represented the shared insight of market participants into future 
developments. However, we now know that this was not the case in many markets, especially during the crisis, as 
forward price curves follow the cycle rather than predict it. 


Second, managers placed too much confidence in mathematical models and de-emphasized the role of human 
judgmentin risk analysis and decision making. Indeed, many equated complexity in risk models with predictive reliability 
and accepted analytical outputs at face value. To put it bluntly, managers often became complacent about the accuracy 
of their risk models, neither validating the key underlying assumptions nor questioning counter-intuitive conclusions. For 
example, until recently, few questioned why a mortgage CDO tranche was assigned an AAA rating, like a high-quality 
plain-vanilla corporate bond. Similarly, few disputed the reliability of life-insurance-embedded value models, despite the 
fact that these complex models rely on a small number of highly critical assumptions, and are highly sensitive to minor 
changes (Exhibit 2). Consequently, a false sense of security (i.e., complacency) blinded many organizations to material 
changes in the ecosystem, and they were unable to respond even when reality no longer behaved in the way anticipated 
by the models. Models are based on specific assumptions, and to use models properly managers must understand 
these assumptions thoroughly. 


Risk modeling in a new paradigm: developing new insight and foresight on structural risk 


Exhibit 2 
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SOURCE: McKinsey 


Stress-testing is another area where the complacency ofmanagers weakened companies’ ability to ascertain risks 
promptly and accurately. Scenarios were usually limited to observed events, and there was little motivation for more 
robust testing, as managers rarely paid attention to them. Additionally, as we now know, stress tests underestimated the 
true impact of many risk-relevant factors. 


An effective antidote to some of the intellectual lassitude of managers regarding risk analytics is the translation of 
analytical outputs into the P&L. That is, how much would we lose if x were to happen? Unfortunately, most management 
information systems failed to capture structural risk metrics or to quantify their potential impact on daily P&L and balance 
sheets — the real indicators whether an institution is doing well or going bankrupt. This situation encouraged write-offs at 
the beginning of the crisis, which are now likely to become self-fulfilling prophecies (Exhibit 3). In addition, risk modeling 
tools focused on mark to market were rarely able to simulate the accounting impact of risk. 


Overreliance on the risk models and tools designed to assist managers in tactical medium-term positioning and short- 
term risk mitigation was clearly an exacerbating factor in the crisis. While mathematical models play an important 
supporting role, managers must fully acknowledge that these models provide only a limited view of reality and should not 
in any circumstance substitute for sound managerial judgment. 


If existing tools are not the answer, what do managers need to better steer their business in the future? Are there 
alternatives to overloading managers with data applicable only to short-term decision making? Will new regulations for 
the banking and insurance industries — historically the benchmark in risk management - provide guidance on the right 
approach and tools for these sectors and beyond? 


Exhibit 3 
Risks from accounting and economic perspectives DISGUISED CLIENT EXAMPLE 
through credit risk-related losses, Q1 2008 
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SOURCE: McKinsey 


Do new financial regulations show the way? 


Before the crisis, the Basel Il regulation raised hopes that the quality of risk management would improve. Indeed, it 
brought significant improvements in many areas, such as risk tracking, processes, and decision making. Despite the 
positive effects of Basel Il, however, some of the regulation’s shortcomings may have contributed to the crisis: 


= The strong pro-cyclicality of capital requirements exacerbated the race to increase returns on RWAs, and fueled the 
credit crunch when the cycle turned. 


= Theexpectation that capital requirements would fall under Basel Il provided banks an additional reason to exploit 
vigorously all means and regulatory opportunities, including optimizing models to allow for greater leverage. 


= The treatment of assets in the trading book and excessive reliance on value-at-risk models led to a very short-sighted 
perspective on risk and a higher level of volatility. Many observers have discredited this aspect of the regulations. 


= The focus on complying with the requirements distracted many institutions from paying sufficient attention to risk 
factors not there covered, such as liquidity risk, and these proved critical in the crisis. 
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Basel Ill aspires to make the banking system safer by redressing many of the flaws that became visible in the crisis. The 
new thresholds for capital and funding will have a substantial impact. Supposing no further changes, the capital needed 
to meet the Tier | requirements of Basel Ill is equivalent to almost 60 percent of all European and U.S. Tier 1 capital 
outstanding. At the same time, the new short-term liquidity ratio (LCR) and net stable funding ratio (NSFR), the details 

of which are still being worked out) will pose a significant challenge to banks. Basel Ill means higher costs and closer 
scrutiny, and banks will need to redefine their business models in orderto restructure their balance sheets and optimize 
the use of capital and liquidity. 


The higher capital requirements and tighter funding ratios “automatically” define the boundaries between “default” 

and “survival,” but they do nat fully address the need for resilience in the banking sector. If an institution is to gain a 
competitive advantage from the new requirements, it must go beyond “ready-to-use” or “off-the-shelf” risk solutions, 
which, as many have argued, can facilitate “nerd behavior.” Instead, each institution must build tools that sharpen its 
vision of customers, markets and the economy at large by capturing and analyzing proprietary historical data. Ideally, this 
operational effort should be part of a holistic strategic effort to steer the organization toward anew generation of success. 


For insurers, Solvency Il has yet to address weaknesses inherited from Basel Il, such as the tendency toward collective 
“herd” behavior and the lack of mechanisms for proactive management of cycles and structural risks. Solvency Il may 
even exacerbate some problems. For banks, Basel Il.5 and Basel Ill have extensively revised risk methodologies but 
leave many things on the shoulders of banks. There are many elements about risk parameters and calculations (e.g., 
what enters into Tier l), but these changes do not add up to a substantively new methodology. Across the financial 
services industry, institutions must recognize that higher requirements and closer supervision will never automatically 
address future technological innovations, market developments and economic crises. The winners will be institutions 
that move beyond mere regulatory requirements to manage risk better than their peers. 


Using insight and foresight to mitigate risk through changing circumstances: 
anew four-step process 


Bank and corporate managers are demanding a new generation of risk modeling that goes beyond transparency and 
enhances their ability to see competitive opportunities as well as to recognize the harbingers of economic change. New 
tools are available, but in order to make the organization truly resilient, managers must radically change their approach to 
risk decision making. They should pursue a proactive and strategic approach, using insight and foresight to identify and 
mitigate emerging risks. 


This new approach comprises four steps: understand your risks, decide which risks to own, anticipate new risks, and 
know when to act. Exhibit 4 displays the actions and new risk tools that define and support each step. 


1. Use your organization’s insight to understand your risks 
As afirst step, top managers should identify the structural risk drivers of their business and then calculate the quantitative 
impact of each risk driver on the P&L and balance sheet, in a series of scenarios ranging from mild to severe. A market 


in which such relationships are already well known can illustrate how the approach works: forecasting the health of the 
office space market is possible based on just a few indicators (Exhibit 5) 


2 See McKinsey Working Papers on Risk Number 27, “Basel Il and European Banking,” and Number 28, “Mastering ICAAP.” 


Exhibit 4 


Strategic risk identification and mitigation — the concept 
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SOURCE: McKinsey 


Exhibit 5 


Interdependencies of risk factors need to be assessed by business ExAMPLE 
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investments, fund volume) 


SOURCE: McKinsey 
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Financial institutions should identify the P&L and balance-sheet impact for each main category of risk driver. From a 
risk modeling standpoint, they will need to develop a comprehensive risk mapping tool (Exhibit 6 shows a simplified 
example). This tool should highlight the top five to ten sources of risk with the most severe impact on the business and 
show the exact points where each risk driver hits the P&L statement. For example, bank managers could ask: “If real 
estate prices drop by 10 percent, what happens to the provisions of our mortgage portfolio?” While such models may 
perform at a high level, putting them in place often takes intense effort. 


Exhibit 6 
Risk mapping tool — example of output ILLUSTRATIVE EXAMPLE 
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1 Forecast for 2010 - 11 is modeled, but not shown for simplicity 
SOURCE: McKinsey 


By drawing on proprietary market and customer data residing in diverse areas (e.g., sales, customer service, finance, 
and risk management), an institution can develop the insight necessary for the clearest possible view of its risks. Itis 
important to train the organization while at the same time building support tools for knowledge gathering and analysis. 
Since this approach relies on identifying risk factors that are inherently instable and require constant review, it is 
important to reach a point at which the risk unit systematically develops and continuously accesses the full insight 
available within the organization. 


2. Decide which risks to own in order to optimize your competitive position 


While the first step produces insights into potential structural risks, the goal of the second step is to determine the 
organization’s proper risk position — which risks it really should own and which should be off-loaded. To do this, 
managers must translate the insight achieved previously into an understanding of how underlying risk drivers might 
evolve according to scenarios that express varying levels of uncertainty. 


Managers should think through a limited set of consistent scenarios for the possible evolution of key “foreseeable” risk 
drivers (or “known unknowns”). These might include changes in the level of demand in certain segments, interest rates, 
default rates, oil prices, etc. In addition, managers should consider hypothetical interdependencies among diverse 
market risk factors and gauge the potential impact of these interdependencies on the P&L and balance sheet. These 
“stress tests” enable managers to assess the resilience of the business in “extreme” states of the world (i.e., unanticipated 
industry discontinuities or “unknown unknowns”), such as the break-up ofthe oil-gas correlation in some European 
markets, the sudden breakdown of the interbank market, or a slow-down in China’s growth. 


On the modeling side it is important to train the organization to express the appropriate range of uncertainty in designing 
scenarios, and the actual risk-takers should have a hand in identifying key risk factors and estimating the possible course 
of their evolution. The fundamental aim is that management understands the sensitivity of the actual P&L and balance 
sheet to potential developments, both adverse and positive (Exhibit 7). The essence of the approach lies in the debate 
through which managers reach a consensus on potential scenarios and outcomes. This will not always be a comfortable 
dialogue, as itis in part a rehearsal for real decision making under stressful conditions. 


Exhibit 7 
Scenarios should express the "uncertainty" while stimulating top 
management understanding of sensitivity of the P&L against risks 
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SOURCE: McKinsey 


The sensitivity analysis is the cornerstone of a robust process for planning under uncertainty, and it prepares managers 
to maintain the optimal risk position of the company in all circumstances. By examining the possible evolution of key risk 
factors, managers should decide on three types of actions (Exhibit 8): 
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i. No-regrets moves, interventions that improve the company risk-return position anywhere in the world: for example, exit 
a fundamentally unattractive business line or reduce wasted liquidity and/or capital — on average we find a 10 percent or 
15 percent slack, respectively, across industries due to inefficient processes and approaches. 


ii, Hedge against the unacceptable, where management finds out that, in case such events occur, the company would 
be unacceptably exposed - especially compared with peers. These cases do not necessarily mean exiting immediately 
from all positions, but can also lead to investing in increased flexibility to move proactively. 


iii. Trigger-based moves, which will be quickly translated into action — as the decision has been “already taken” — based 
on early warnings ifa specific event materializes; for example, secure long-term funding even at high costifone's own 
readiness to lend to other counterparties reduces due to deteriorating ratings. 


Exhibit 8 
Managers should adopt a systematic approach ILLUSTRATIVE EXAMPLE 
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SOURCE: McKinsey 


This approach supports management decision making on risk positioning by defining scenarios based on different levels 
of the main structural risk drivers. Such risk modeling requires both scenario planning for the analysis of “P&L-at-risk” and 
a stress test tool that translates structural risks into “extreme but possible” business scenarios. This method differs from 
traditional capital-at-risk approaches in three key ways: 


= Focus on “realeconomics”: The output takes the form of P&L and balance sheet numbers, not the mark-to-market 
figures of NPV-based approaches (“fiscal accounting”). 
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= Comprehensive rather than partial: Scenarios should be consistent, and should be applied across all the relevant 
risk factors. The aim of the approach is thus to capture interdependencies comprehensively by, for example, moving 
from siloed assessments of credit, market, and liquidity risk in banking to an integrated view. 


= Used to create awareness: The point of the exercise is not to assume that risk assessment can determine the “true” or 
most likely outcome. Hence, the method we propose focuses less on exhaustive granularity and emphasizes instead 
the use of insight to evaluate impact. In our experience, this approach helps board members better understand 
structural risk drivers and the interdependencies among them. As aresult, managers make better decisions and are 
better prepared to take action if the level of perceived risk increases. 


We are aware of the organizational and cultural difficulties this effort entails for many institutions, especially in terms of 
bridging risk management and accounting approaches. However, risk translates into real P&L losses, balance sheet 
developments, or liquidity issues. These are the numbers that regulators and financial analysts actually look at to 
determine acompany’s well-being, and managers must “stay in shape” for prompt and systematic action to defend the 
bottomline. 


3. Anticipate new risks with tools that provide foresight into changing economic conditions 


Fundamentally, we must recognize that some risks are not foreseeable (“unknown unknowns’). Especially in light of 
the recent crisis, however, much can be gained by systematically tapping the organization’s knowledge of what could 
happen in the future (“known unknowns’). The aim is not to predict the future, but to focus on detecting early-warning 
signals in order to respond sooner. 


Four actions can best safeguard against adverse foreseeable risks: (i) continuously measure the level of each structural 
risk driver; (ii) derive early-warning indicators to improve assessment of the likelinood of adverse developments; (iii) revise 
the probability of each scenario and define the reference scenario for action; and (iv) transform the contingency plan into 
amore detailed action plan if adverse scenarios are increasingly likely. 


Early-warning indicators are a particularly important part of this process. For instance, it would have been possible 

to detect the critical situation leading to the recent real estate bubble in the United States by looking at just four main 
indicators: (i) home ownership costs went up by 25 percent from 2004 to 2007, while rental costs remained largely stable; 
(ii) real estate prices grew much faster than GDP per capita in the same period of time; (iii) debt share (i.e., mortgages) 

on the residential housing stock peaked to reach 52 percent; (iv) LTV mortgages increased to 33 percent in 2006 from 8 
percent in 2003 (Exhibit 9). 


Firms should develop a structural risk early-warning tool aimed at regularly tracking emerging structural risks by fully 
leveraging information within the organization (e.g., structured interviews with risk takers and selected external sources 
to concentrate on relevant risk sources only). A limited set of KPIs carefully identified for each specific market make it 
possible to spot potential market anomalies and the level ofthreat they pose. 
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Exhibit 9 


In hindsight all early-warning KPIs strongly suggested a "bubble" ExAMPLE 
in the US real estate market 
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1 Monthly payment for a home mortgage including tax shields and utilities 


SOURCE: Mortgage bankers associations; Census Bureau; Federal Reserve Bank; McKinsey analysis 


4. Know how and when to act to mitigate emerging risks 


Many key decision makers at banks were growing increasingly worried before the crisis, yet they did not get out of the 
game when they should have. The final hurdle financial institutions must overcome is developing detailed plans for 
disciplined responses to early-warning triggers. Being quick and decisive involves two steps: (i) executing the action 
plan defined for the contingency in question, or adapting it as the situation demands especially ifan “unknown unknown’ 
occurs, and (ii) monitoring the results and impact of this response. 


Contingency plans should fulfill a set of minimum requirements. A contingency plan tracker can help firms monitor the 
success rate of the action plans once they are launched and, using a feedback-based approach, understand the P&L 
at risk after they are completed. For instance, if we look again at the mortgage origination business, an action plan for 
the “real estate bubble bursts” scenario would have included a set of clearly defined risk mitigation initiatives, such as 
the increase in underwriting no-go decisions, the introduction of more stringent LTV policies, and an initial campaign for 
high-DTI clients (Exhibit 10). 
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Exhibit 10 
Risk action planning - application to credit risk for mortgages 
(applying foresight before the crisis) 
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SOURCE: McKinsey 


x KOK 


Valuable lessons have been learned about the limitations of risk models, which cannot replace managerial judgment. 
There is no magic oracle for generating the right risk decisions, and companies need to incorporate stronger, more 
strategic “human intervention” into their processes for identifying and mitigating risk. First, financial institutions should 
develop clear insights on the structural risk drivers influencing their performance, fully drawing on the information 
available within the organization. Second, they must recognize where they are not the “natural owners” of specific risks 
and be prepared to unload the ones which either they do not understand or which do not enhance their competitive 
positioning. Third, they must anticipate new potential risks with tools that provide foresight into changing economic 
conditions. Finally, they should develop contingency plans to be ready to respond to changing market conditions. This 
approach requires undertaking deep procedural and organizational changes to enable and encourage decision makers 
to think strategically about the constant risks of doing business. 


The supporting tools discussed above form only one of several aspects of the new risk management paradigm. Other 
aspects include: strategic risk ownership; resilient organizational structure and decision making processes making it 
possible for the parts of the firm to be proactive in risk mitigation; and a robust risk culture. This approach will not give 
managers the power to predict the true future state of markets. Rather, it recognizes that the future remains unpredictable 
and gives managers tools with which they can prepare themselves and their organizations to (re)act flexibly and quickly. 


Silvio Angius is a principal, Carlo Frati is an associate principal, and Marco Piccitto is a principal, all in the Milan office; 
Arno Gerken is a director in the Frankfurt office, Philipp Harle is a director in the Munich office, and Uwe Stegemann is 
a director in the Cologne office. 
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